Jetty 9.3.0 to 9.3.8 inclusive is vulnerable to an aliasing issue when running on Windows platform.
The vulnerability allows raw file resources protected by security constraints or in WEB-INF to be revealed. Only resources within the webapp are vulnerable.
The issue was fixed in release jetty-9.3.9
, which is available via eclipse download
or in the maven central repository
. A work around is also documented in the ocert announcement below. Rewrite rules and/or filters can be installed that disallow URIs containing the \ character.
This vulnerability is an example of an alias vulnerability, where a resource on the file system can be accessed via different names. Thus if a security configuration allows all URIs except for specific patterns, then any aliases that bypass the specific patterns can create a security vulnerability. Since updates to files systems and/or JVM libraries can (and has) introduced new types of aliases, it is good security practise is to install a deny constraint on all URIs and then selectively allow specific URIs.
The Jetty team would like to acknowledge the assistance of ocert
in finding and handling this issue.